Sunday 27 September 2026
Afternoon EditionRSS

ZOTPAPER

News without the noise

ZOTPAPER
Security

ShinyHunters bypasses WAF protections in renewed Oracle PeopleSoft attacks

URL-encoding trick lets attackers reach vulnerable endpoint despite firewall rules

edit
By LineZotpaper
Published
Read Time2 min
The ShinyHunters extortion gang has developed a URL-encoding bypass technique to circumvent web application firewall rules that were mitigating a critical Oracle PeopleSoft vulnerability, allowing the threat actors to resume widespread exploitation of unpatched servers, according to a new report from Google's Mandiant and Threat Intelligence Group.

The bypass technique exploits a discrepancy in how URL paths are interpreted by many WAFs and reverse proxies versus Oracle WebLogic. Instead of sending requests to /PSEMHUB/, the attackers substitute a percent-encoded version — /%50SEMHUB/ — where %50 represents the letter 'P'. Many WAFs compare the literal request path before decoding it, missing the encoded variant, while Oracle WebLogic decodes the path and routes requests to the vulnerable endpoint.

Mandiant warns that ShinyHunters may use other encoding variations, such as mixed-case or additional percent-encoding, to evade detection. The group, tracked by Google as UNC6240, has deployed web shells on dozens of systems worldwide, primarily in the higher education sector.

In June, BleepingComputer reported that ShinyHunters was targeting Oracle PeopleSoft servers using a zero-day vulnerability, eventually patched as CVE-2026-35273, which allows unauthenticated remote code execution. At the time, Mandiant advised organizations that could not immediately apply the patch to block external access to the /PSEMHUB/* endpoint — a mitigation now undermined by the new bypass.

Mandiant urges organizations to install the latest security update rather than rely solely on WAF rules. They also recommend reviewing WebLogic access logs for requests to /PSEMHUB/ and encoded variants to detect signs of exploitation.

§

Analysis

Why This Matters

  • Organizations that relied on web application firewall rules instead of patching now remain exposed to data theft and potential ransomware deployment.
  • The higher education sector, a frequent target, faces continued risk of sensitive information loss and operational disruption.
  • The bypass technique highlights a fundamental limitation of WAFs and underscores the need for timely patch management.

Background

In June 2026, the ShinyHunters extortion gang began exploiting a zero-day vulnerability in Oracle PeopleSoft servers, stealing data from at least 100 organizations. Oracle released a security update on June 11, designating the flaw as CVE-2026-35273 — an unauthenticated remote code execution vulnerability. Google's Mandiant confirmed the group was actively targeting the education sector. When patches could not be applied immediately, Mandiant recommended blocking access to the vulnerable /PSEMHUB/ endpoint through WAF configurations. The new URL-encoding bypass undermines that advice, forcing organizations to prioritize patching.

Key Perspectives

Security professionals and incident responders: The bypass demonstrates that WAF rules are not a substitute for patching. Mandiant stresses that only applying the security update can properly mitigate the vulnerability. Threat actors (ShinyHunters): The group continues to adapt its techniques to maintain access to valuable data, targeting sectors with limited resources for rapid patching. Oracle users and IT administrators: Many organizations face challenges in applying patches immediately due to testing requirements and operational constraints, leaving them reliant on alternative mitigations that can be circumvented.

What to Watch

  • Indicators of more sophisticated encoding variants — the use of double encoding, mixed-case, or alternate percent sequences.
  • Whether Oracle releases an additional advisory or the prevalence of exploitation forces further guidance.
  • Signs of similar WAF-bypass techniques being adopted by other threat actors targeting known vulnerabilities.

Sources

newspaper

Zotpaper

Articles published under the Zotpaper byline are synthesized from multiple source publications by our AI editor and reviewed by our editorial process. Each story combines reporting from credible outlets to give readers a balanced, comprehensive view.

Editorial ProcessSubscribe